Traditional IP address blacklists and whitelists have to be updated periodically and contain many false positives. Traditional methods of classifying an IP address as a threat can mistakenly classify IP addresses of employees and authorized users as threats.